Session fixation attack, cookie based sessions over https

A third party security consultant did a Penetration test few of our webapps. One of the findings was a potential session fixation vulnerability.

We have several webapps all Java with single sign on provided by JASIG CAS. To briefly summarize CAS workflow — when a new request comes to webapp(service in CAS terminology) it redirects to preset CAS url. If the user is not already authenticated, it presents a login form and upon successful redirects the browser back to the service with a token. In case the user is already authenticated, it immediately redirects back to service with a token.

The aforementioned vulnerability stems from the fact that the service in question sets the session cookie (named JSESSIONID) when it is redirecting to CAS ie before authentication AND continues to use it after redirect. The claim is since same session id is used before and after authentication it is open to session fixation types of attack.

Given that all services and CAS are working exclusively over https and session cookie is secure, http only and generated at server, is there any way session fixation may be a threat here ?

All topic

How do I add a column to a Pandas dataframe based on other rows and columns in the dataframe?

I’ve tried a lot of different methods, but I can’t seem to find the right way to do this. I want to create a new column based on the time and id of the df. However, ids appear multiple times. Here’s my dataframe:

df = pd.DataFrame({'time': [1,2,3, 1, 2 ,3],
'id': ['A', 'A', 'A', 'B', 'B', 'B'],
'num': [10,11,12, 20, 21, 22]}
)

and its output:

id num time
A 10 1
A 11 2
A 12 3
B 20 1
B 21 2
B 22 3

What I want is that for the new columns value to be the num value for time==1 for each unique id. Here’s what I would like the output to be:


id num time y
A 10 1 10
A 11 2 10
A 12 3 10
B 20 1 20
B 21 2 20
B 22 3 20

One attempt I’ve made is to make a reference table made like this:

df['y'] = np.where(df['time']==1, df['num'], None)

ref = df[['id','y']]

ref = ref.dropna()

But I still don’t know where to go from here. Thank you!

All topic

Combining fluid flow solver based on lattice Boltzmann method with a mechanical deformation solver based on finite element method

I’m thinking to couple my fluid flow solver based on lattice Boltzmann method with a mechanical deformation solver based on finite element method to take account for solid deformation in my models. In fact, I’m looking for a fluid-structure interaction framework, which its fluid solver was written based on lattice Boltzmann. I didn’t find any opensource example by using this coupling idea. Can anyone suggest any opensource software or direction how it is possible to do it?

All topic

Web Based Project Management software with Scrum and Kanban

So as a background of what is going on:

I am starting up a company in which will be dealing with game development, the problem comes where as many things a start-up is exactly that. Starting up, and in turn has a lack of revenue at least for now. So any answer that comes along has to be affordable, or free, and if possible have the ability of having iPhone, Android, and Desktop interaction as well… the last three are a bonus, but I’ll take web based for now if that is all there is.

I am looking for either Open Source, or other that project management web app that I can host myself on my own server, so I can control all aspects of the program and server, and not worry about some third party going out of business and taking their ball home and shut a site down half way though getting a project out the door.

JIRA can be hosted on a computer yes, but a computer, and not just a web server, which means another kettle of worms.

So I am looking for a web server hosted program that can do Project Management, Scrum and Kanban, if at all possible.

I am basically looking for a service that can allow an admin to host, managers to produce the work flow and place jobs for people to do, and people to do the jobs, but at the same time give it a stepping stone upon where they are. So in English go from something like this:

I give it to a writer he/she then goes through and does their steps.

  • Accepted
  • First Draft
  • First Review
  • Second Draft
  • Second Review
  • Final Draft
  • Final Review
  • Finished

Then if need be it would be given to someone else as another project such as a programmer, and they would have their own list.

I basically need something that is geared towards concept to final product in Project Management Software that can handle several groups at once. If this makes any sense?

Any help would be appreciated.

All topic

Python – Script to Assign Materials based on Mesh Name

hoping someone may be able to help out with a script to automatically assign materials to meshes based on their names. I’ve not had any Python experience so it’s all a bit beyond me.

I’m importing a series of car models (FBXs each consisting of around 25 mesh objects) into a scene to render (Cycles) and need to apply materials to the selected meshes (ideally more than one at once). The materials have already been created in the scene and applied to temp meshes (moved to layer 2). Each mesh object from the imported FBX has been named to match the material that needs to be applied (eg. “Car_Tyres” mesh needs “Car_Tyres” material applied).

Can someone help me out with a script or point me in the direction of a solution, I’ve had no luck searching previous questions on here. Thanks heaps for your time 🙂

All topic

Link multiple charts based on multi select listbox – Microsoft access

How can I link multiple charts which are made from crosstab’s query to a multiselect listbox in a form?

All my forms individually work perfectly – I can make a selection from the listbox, filter the data and create a report based on the filtered data.
How I’ve done this is:

  1. Create a query with the fields in which the filter is applied.
  2. Create a crosstab of the query from above.

Now, what I’m trying to do is…to have multiple charts dynamically change based on selected values of the listbox.

All topic

new vector layer’s field based on other layers attributes – “for”cycle error

I’d like to create a new field in vector layer A, based on attributes in vector layers B and C but PyQgis returns a series of wrong numbers, particularly just the first feature value of the field C (I suppose the error is in the for cycle’s script/sequence). Could you help me?

featuresB=layerB.getFeatures() 
featuresA=layerA.getFeatures() 
featuresC=layerC.getFeatures()    
for fA in featuresA:
    for fC in featuresC:
         for fB in featuresB:
             if fA.geometry().area()*2>=fB.geometry().area():
                print fC[field_x]
             else:
                print fA[field_y]

All topic

Value of Product Based on Bitcoins

If I chose to accept Bitcoin as a payment for my product, and the price of the bitcoin goes up or down, then technically I am not getting as much for my product in the long run correct? Because the exchange is based on the dollar as one of the currencies. So If my product cost’s 100.00 and that is a certain percentage of a bitcoin then if the bitcoin say its worth 7100.00 that would be .014 bitcoins. But if the bitcoin decreased in price say to 5100.00 then that same product would cost .019 bitcoins. Correct? How dos the fluctuation in price affect the value of my product in dollars?

All topic

Add object to dictionary based on key in Python 2

I’m trying to add an object/dictionary to my already existing dictionary based on key, but the already existing object is being overwritten.

What I am trying to achieve:

'CXR100': {'MeSH': {u'major': [u'normal'], u'minor': []}, {u'major': [u'normal'], u'minor': []}}

What I am getting:

'CXR100': {'MeSH': {u'major': [u'normal'], u'minor': []}}

My code:

data = dict()
for record in records['list']:
    if data.get(record['uid']):
        data[record['uid']]['MeSH'].update(record['MeSH'])
        # have tried: data[record['uid']]['MeSH'] += {'MeSH': record['MeSH']}
    else:
        data[record['uid']] = {'MeSH': record['MeSH']}

print(data)

I have been programming PHP/Laravel for the past two years and have totally lost my feeling for Python. I hope someone can give me directions on what I am doing wrong.

All topic

Rsync copy folders to different destinations based on content of a file

iam trying to backup some folders to a remote NAS.
In every source folder there is a file with the started year of the project.
i want to sync those folders to a corresponding folder year name.

Exampe project 1 has a file started_year with 2018. i want to sync that folder to a offsite nas in to the 2018 folder.

We have many many project folders started in differtent years.
What is the best way to implement this in a Bash script?

Thanks in advance!

All topic